hxxps://drive[.]google[.]com/drive/search?usp=manage_all_todos_url&q=followup[:]actionitems&usp_dm=false

Analysis

max time kernel
23s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/search?usp=manage_all_todos_url&q=followup:actionitems&usp_dm=false

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133747790934260665"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2878641211-696417878-3864914810-1000\{996099DB-2EEF-40BE-B84C-406B09E16593}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4384	4104	chrome.exe	84
PID 4104 wrote to memory of 4384	4104	chrome.exe	84
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 1352	4104	chrome.exe	85
PID 4104 wrote to memory of 4652	4104	chrome.exe	86
PID 4104 wrote to memory of 4652	4104	chrome.exe	86
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87
PID 4104 wrote to memory of 4032	4104	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/search?usp=manage_all_todos_url&q=followup:actionitems&usp_dm=false
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb5edfcc40,0x7ffb5edfcc4c,0x7ffb5edfcc58
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4484,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4448,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4432,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5052,i,14314708740548624216,17037836558734241506,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4512

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
32428be09150afd3fd55924923c229b8

SHA1
4df378ba027f7b03e87319104335412d11206028

SHA256
648648d9fe118ad8825d7681563d6997833e2d1a28c468428018c1c4e1f8cc5c

SHA512
14ae65727d3e14a055babb8a8984b4b11f3e952f6db7a79f1ac21ba8b89952c86423fcdcc686325ec279c8662e126db0c94ba81005da8500242f2d412b37a6a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
384B

MD5
34ed457dcce83f71144fd7725a2ba1b1

SHA1
538bef2aeee4fb02c4a871ca163302d7fc60f5e2

SHA256
da58ba006fa003486228311add9763bf0a3514c24f2cafd399c3c0ab8a86f0b6

SHA512
db78717975a97071f309b55f20620d47d07c67bd95de1d88747e317a04bad8d6e9d5de4a44b47ba3c59cafd81c68a32a4bf8249252c6a77cdc9c6602dbb11818

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
aecc94c4cd3e997fd4d0dcc7adbf559f

SHA1
6fcc78dc84a3d756aa921e88f960a00f15028d91

SHA256
9694916cf4a5da7a285378ec75d41d983638d6716ca324a8474db57b92cd56cc

SHA512
a5f9501668da4bf771bf06e3b5adf553a71d3d8b19068ca518f1f88835900e4e9866a7d14cc6d27ac32a5b82b71253f2ec14d4c20c0fb9357c042fef567b55d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3e701219a202fba6365f4925ef440eaf

SHA1
4ae71b0762578ef678f2b539a7db029bab6ee562

SHA256
bd923022091266762bb25f4fde1438f695385a0a68d5234a904fd9be83442b4b

SHA512
54b8f6458562536383909a44bb289e2c4f42034e0e502cc517fcde7abe734864ca93b3fac3a45b26a5622a29faabb1768b56adc128bb270d957964e2fcd73944

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
bbf286fc871e7127adb9642b96977d58

SHA1
7b4ceff5824907b9f30d4fb5fac5eb8a3d5695fd

SHA256
b09684dba084c11f43850ddcf1eb517dd90205f9554e0440ae675b8624f8c446

SHA512
8ef3897bb6563c5fc86e7eec7b2580b222779fabbde3f05197df34302f37c728f1cbc7a0e48fc921693851f08b55a35065ea5e2f8489b9c7df355df9aac7836e

Download Submit